Umbrella company reform April 2026: agency PAYE liability explained

Since 6 April 2026, a recruitment agency that supplies contractors paid through an umbrella company can be made to pay that umbrella's unpaid PAYE and National Insurance. The umbrella company reform moves the tax risk up the supply chain to the agency holding the contract with the end client, and there is no due diligence defence. If you run a temp or contract desk and any of your workers are paid through an umbrella, this is now your liability as much as theirs. This post explains how agency PAYE liability works under the new rules, who carries it, and what to check and document so you aren't the one paying when an umbrella disappears.

What changed on 6 April 2026

The umbrella company still has the primary duty to operate PAYE on its workers' pay. What's new is that HMRC can now recover any shortfall from another business in the chain, which the legislation calls the 'relevant party'. The umbrella and the relevant party are jointly and severally liable, so HMRC can go straight to whichever one can pay.

The rules sit in a new Chapter 11 of Part 2 of ITEPA 2003, with matching legislation for National Insurance. They cover PAYE income tax and Class 1 NICs, and they apply to any payment made to an umbrella worker on or after 6 April 2026, however long the contract has been running. Existing supply chains are caught in full.

The target is umbrella non-compliance, especially the mini umbrella company fraud and disguised remuneration schemes that have cost the Exchequer for years. HMRC's view is that the agency is best placed to stop it, because the agency picks the umbrella.

Who is liable: the agency, the end client, or both?

In most chains the relevant party is the agency that has the contract with the end client to supply the worker. In a simple chain (client, agency, umbrella, worker) that's you.

A few situations shift the liability:

• No agency in the chain. If the end client contracts directly with the umbrella, the end client is liable.
• Offshore agency. If the end client contracts with an agency that isn't UK resident, liability moves to the end client.
• Connected agency. If the agency is connected with the umbrella company, the end client becomes liable. Clients have a reason to ask who owns the businesses above them.
• Offshore client and agency. If neither the end client nor its direct agency is UK resident, liability falls on the UK-resident agency closest to the end client.
• Fraudulent arrangements. Anti-avoidance rules catch 'purported' umbrella structures where the worker isn't really employed by the umbrella, including vehicles connected to the worker.

For a typical UK agency with a direct client contract, the answer is simple. If the umbrella you use fails to pay, HMRC can come to you.

What's out of scope: workers engaged through their own personal service company (those stay under IR35 and the off-payroll rules), managed service companies, and umbrella arrangements where the umbrella itself controls how the work is done, which are treated as an agency under the existing debt transfer rules.

Why 'no defence' is the part that matters

Most supply chain rules give you a way out if you took reasonable care. These don't. There is no reasonable excuse defence and no knowledge-based defence, and no right of appeal against being named the relevant party. An agency can be liable even if it didn't know about the non-compliance, even if it was lied to, and even if it carried out due diligence.

Two practical consequences follow. Indemnities in your umbrella contract are worth very little on their own, because the umbrellas most likely to default are the ones most likely to have been wound up by the time HMRC calls. Accreditation (FCSA, SEC, Professional Passport) helps you pick better providers, but it doesn't transfer your statutory liability to anyone else.

Due diligence therefore can't protect you after the fact. Its value is in cutting the chance of a default happening at all, and in giving you a clear record if one does.

Umbrella due diligence: what to check

Treat your umbrella list as a supplier panel, not a list of names candidates happen to mention. A reasonable baseline:

1. Approve a short preferred supplier list. Fewer, better umbrellas you've actually vetted. Refuse unknown providers, even when a contractor asks for one.
2. Check the company, not the brand. Companies House filing history, directors, age of the company, and whether it's connected to your business or to other parties in the chain.
3. Require accreditation from a recognised body as a minimum, not as the whole check.
4. Ask for proof of PAYE being paid. Evidence of RTI submissions and HMRC payments, reconciled to what you've invoiced. This is the check that catches problems early.
5. Review a sample of payslips each month. Compare the gross assignment rate to what reaches the worker. Look for unexplained deductions, 'loans', or pay split into odd components, which are classic signs of a scheme.
6. Re-check regularly. A compliant umbrella can change hands or stop paying. Quarterly reviews at minimum, with a trigger to re-check on any change of ownership or bank details.
7. Ask your end clients about their chain if you sit below another agency, and ask them what they need from you. Their procurement teams are now asking these questions too.

What to document

When HMRC comes asking, you'll want to show exactly who was in the chain, what you checked, when, and what you did about anything unusual. Keep:

• a current map of every placement: client, agency, umbrella, worker, and the contract linking each;
• the date and outcome of each supplier check, with the evidence attached;
• monthly payment reconciliations against umbrella invoices;
• a log of any issues raised with an umbrella and how they were resolved or why you dropped the provider;
• updated contracts, including audit rights, prompt notice of HMRC enquiries, and the right to stop using the umbrella immediately.

Six months in: where agencies are getting caught out

Most agencies updated contracts before April. Fewer changed the day-to-day process. The gaps we see most often are practical ones: umbrella choices still left to the individual consultant, supplier checks done once at onboarding and never repeated, and placement records scattered across the CRM, spreadsheets and email, so nobody can answer 'which umbrella is this worker paid through?' without asking around.

That last gap is the dangerous one. You can't monitor a supply chain you can't see in one place. The agencies in the best position have moved umbrella selection into a controlled list inside their systems, attached supplier checks and renewal dates to each umbrella record, and tied every timesheet to the umbrella it's paid through.

It also connects to the wider regulatory picture. The Employment Rights Act 2025 extends employment agency regulation to umbrella companies, so expect supply chain scrutiny to keep tightening. We covered the timeline in [Employment Rights Act 2025: what recruitment agencies must do in 2026].

Build compliance into the tools you already use

Umbrella due diligence is mostly a data problem. The information you need already passes through your business in timesheets, invoices and placement records. The work is making sure it's captured, linked and reviewed on a schedule instead of assembled in a hurry after HMRC writes.

This article is general information, not legal or tax advice. Take professional advice on your own supply chains.